CVE-2025-46548 | Medium | 6.5 | 2025-06-03 | If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied.
Users that rely on authentication i… |
CVE-2023-33251 | Medium | 4.7 | 2023-05-21 | When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions… |
CVE-2023-31442 | High | 7.5 | 2023-05-11 | In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction I… |
CVE-2023-29471 | Medium | 5.5 | 2023-04-27 | Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is confi… |
CVE-2022-31023 | Medium | 5.9 | 2022-06-02 | Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information… |
CVE-2022-31018 | High | 7.5 | 2022-06-02 | Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms lib… |
CVE-2021-23339 | Medium | 5.0 | 2021-02-17 | This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers. |
CVE-2020-28923 | Low | 2.7 | 2020-12-03 | An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects us… |
CVE-2020-27196 | High | 7.5 | 2020-11-06 | An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type head… |
CVE-2020-26883 | High | 7.5 | 2020-11-06 | In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. |
CVE-2020-26882 | High | 7.5 | 2020-11-06 | In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. |
CVE-2020-12480 | Medium | 6.5 | 2020-08-17 | In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be… |
CVE-2019-17598 | High | 7.5 | 2019-11-05 | An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may somet… |
CVE-2018-18854 | High | 7.5 | 2018-10-31 | Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during t… |
CVE-2018-18853 | High | 7.5 | 2018-10-31 | Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during t… |
CVE-2018-16131 | High | 7.5 | 2018-08-30 | The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a de… |
CVE-2018-16115 | Critical | 9.1 | 2018-08-29 | Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for T… |
CVE-2018-13864 | High | 7.5 | 2018-07-17 | A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows… |
CVE-2014-3630 | Critical | 9.8 | 2017-12-29 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to re… |
CVE-2015-2156 | High | 7.5 | 2017-10-18 | Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow r… |